711145 - Implement a preference for blocking mixed passive content (images, iframes, fonts, etc.)

Status: RESOLVED DUPLICATE of bug 62178

(Core :: Security, defect)

Description

[Brandon Sterne (:bsterne)]

Make the loading of mixed-mode passive content, including _everything other than_ scripts, plugins, and stylesheets, user-configurable and allowed by default.  We can potentially flip this preference in the future when the impact of doing so is better understood.

Check out nsIContentPolicy.idl to see what types of mixed content this would include:
http://mxr.mozilla.org/mozilla-central/source/content/base/public/nsIContentPolicy.idl

Comment 1

[Tanvi Vyas[:tanvi]]

I think an about:config setting would be sufficient for this.

Comment 2

[Brandon Sterne (:bsterne)]

The patch in bug 62178 adds security.mixed_content.block_display_content.  I think we can dupe this bug to that one.

Comment 3

[Tanvi Vyas[:tanvi]]

Yup, just saw that.  Building with your patch now to try it out.  

We might eventually remove the pref for security.mixed_content.block_active_content once we have the blocking UI (hopefully FF 18) - bug 711141.

Comment 4

[Tanvi Vyas[:tanvi]]

This is covered in the patch to bug 62178.